JPWO2020261425A1 - Fraud estimation system, fraud estimation method, and program - Google Patents

Abstract

The relevance information acquisition means (104c) of the fraud estimation system (S) acquires relevance information regarding the relevance of one service to another service. The comparison result acquisition means (105c) acquires the comparison result between the user information of the target user in one service and the user information of an unauthorized user or a legitimate user in another service. The estimation means (106c) estimates the fraud of the target user based on the relevance information and the comparison result.

Description

The present invention relates to fraud estimation systems, fraud estimation methods, and programs.

Conventionally, a technique for estimating user fraud in a service provided on the Internet or the like has been studied. For example, in Patent Document 1, in a system that manages a blacklist indicating a fraudulent user, an action history such as a browsing history of a newly registered user's website is acquired, and the action history of the user in the blacklist is obtained. It is described that the creditworthiness of newly registered users is estimated by comparison.

JP-A-2018-045573

However, there are various tendencies in the behavior of fraudulent users, and even if a newly registered user may cheat, it does not necessarily resemble the behavior history of a user in a blacklist. In the technique of Patent Document 1, only users who behave similarly to the users in the blacklist can be detected, and the accuracy of fraud estimation cannot be sufficiently improved.

The present invention has been made in view of the above problems, and an object of the present invention is to provide a fraud estimation system, a fraud estimation method, and a program capable of improving estimation accuracy.

In order to solve the above problems, the fraud estimation system according to the present invention comprises a relevance information acquisition means for acquiring relevance information regarding the relevance of one service to another service, and a target user in the one service. Based on the comparison result acquisition means for acquiring the comparison result between the user information and the user information of the unauthorized user or the legitimate user in the other service, and the relevance information and the comparison result, the illegality of the target user is detected. It is characterized by including an estimation means for estimating.

The fraud estimation system according to the present invention has the user information of a predetermined item of a target user in one service and the predetermined item of a fraudulent user or a legitimate user in another service in which fraud is presumed based on the user information of another item. It is characterized by including a comparison result acquisition means for acquiring the comparison result of the user information of the above, and an estimation means for estimating fraud of the target user based on the comparison result.

The fraud estimation method according to the present invention includes a relevance information acquisition step for acquiring relevance information regarding the relevance of one service to another service, user information of a target user in the one service, and the other service. Including a comparison result acquisition step of acquiring the comparison result of the unauthorized user or the legitimate user in the above, and an estimation means for estimating the fraud of the target user based on the relevance information and the comparison result. It is characterized by that.

The program according to the present invention is a relevance information acquisition means for acquiring relevance information regarding the relevance of one service to another service, user information of a target user in the one service, and an unauthorized user in the other service. Alternatively, the computer is made to function as a comparison result acquisition means for acquiring the comparison result with the user information of the legitimate user, and an estimation means for estimating the fraud of the target user based on the relevance information and the comparison result.

According to one aspect of the present invention, the relevance information acquisition means acquires a plurality of relevance information corresponding to each of the plurality of other services, and the comparison result acquisition means is used for each of the plurality of other services. The estimation means acquires a plurality of corresponding comparison results, and estimates the fraud of the target user based on the plurality of relevance information and the plurality of comparison results.

According to one aspect of the present invention, in the one service, fraud is presumed based on the user information of the predetermined item, and the comparison result acquisition means is the user information of the predetermined item of the target user in the one service. And, the comparison result with the user information of the predetermined item of the unauthorized user or the legitimate user in the other service is acquired.

According to one aspect of the present invention, in the other service, fraud is presumed based on the user information of the first item, and the comparison result acquisition means is the user of the second item of the target user in the one service. It is characterized in that the comparison result of the information and the user information of the second item of the unauthorized user or the legitimate user in the other service is acquired.

According to one aspect of the present invention, the relevance information acquisition means acquires relevance information regarding the relationship between the first item and the second item in the other service, and the estimation means is the other. Based on the relevance information regarding the relevance between the first item and the second item in the service of the above, the fraud of the target user is estimated.

According to one aspect of the present invention, in the other service, fraud is presumed based on the user information of each of the plurality of first items, and the relevance information acquisition means is the plurality of first items in the other service. The estimation means acquires the relevance information regarding the relevance of each of the one items, and the estimation means fraudulently uses the target user based on the relevance information regarding the relevance of each of the plurality of first items in the other service. Is characterized by estimating.

According to one aspect of the present invention, the comparison result acquisition means has user information of each of a plurality of items of the target user in the one service, and each of the plurality of items of an unauthorized user or a legitimate user in the other service. The user information of the above and the comparison result of the above are acquired, and the estimation means estimates the fraud of the target user based on the plurality of comparison results corresponding to the plurality of items.

According to one aspect of the present invention, the relevance information acquisition means acquires a plurality of relevance information corresponding to each of the plurality of items, and the estimation means is the target based on the plurality of relevance information. It is characterized by estimating user fraud.

According to one aspect of the present invention, in the other service, the user information of the target user in the one service is compared with the user information of an unauthorized user or a legitimate user in the other service, and the comparison result is obtained. The acquisition means is characterized in that the comparison result is acquired from the other service.

According to one aspect of the present invention, the fraud estimation system is based on a comparison result between the user information of a fraudulent user or a legitimate user in the one service and the user information of the fraudulent user or the legitimate user in the other service. It is characterized by further including a setting means for setting the relevance information.

According to one aspect of the present invention, the fraud estimation system further includes a registration receiving means for accepting user registration in the one service, the target user is a user who performs the user registration, and the estimation means is a user. When the user registration is accepted, the fraud of the target user is estimated.

According to the present invention, it is possible to improve the estimation accuracy.

It is a figure which shows the whole structure of the fraud estimation system which concerns on Embodiment 1. FIG. It is explanatory drawing which shows the outline of the processing of a fraud estimation system. It is a functional block diagram which shows an example of the function realized by a fraud estimation system. It is a figure which shows the data storage example of the user database of service A. It is a figure which shows the data storage example of the blacklist of service A. It is a figure which shows the data storage example of the user database of service B. It is a figure which shows the data storage example of the blacklist of service B. It is a figure which shows the data storage example of the user database of service C. It is a figure which shows the data storage example of the blacklist of service C. It is a figure which shows the data storage example of the relevance information database. It is a flow chart which shows an example of the process executed in a fraud estimation system. It is a flow chart which shows an example of the process executed in a fraud estimation system.

[1. Embodiment 1]
Hereinafter, an example of the first embodiment (hereinafter, the first embodiment) of the fraud estimation system according to the present invention will be described.

[1-1. Overall configuration of fraud estimation system]
FIG. 1 is a diagram showing an overall configuration of a fraud estimation system according to the first embodiment. As shown in FIG. 1, the fraud estimation system S includes service providing systems 1a to 1c and a user terminal 20, which can be connected to a network N such as the Internet.

Each of the service providing systems 1a to 1c is a system for providing a service to a user. Each of the service providing systems 1a to 1c can provide any kind of service, and for example, an electronic payment service, a financial service, an electronic commerce service, an insurance service, a communication service, a home delivery service, a video viewing service, or the like is a user. Provided to. In the present embodiment, the services provided by the service providing systems 1a to 1c are described as services A to C, respectively.

For example, the service providing systems 1a to 1c include servers 10a to 10c, respectively. In the following description, when it is not necessary to distinguish the service providing systems 1a to 1c, the service providing system 1 is simply referred to as the service providing system 1. Similarly, when it is not necessary to distinguish the servers 10a to 10c, the server 10 is simply referred to as the server 10. Similarly, when it is not necessary to particularly distinguish the control units 11a to 11c, the storage units 12a to 12c, and the communication units 13a to 13c shown in FIG. 1, the alphabetic symbols at the end are omitted.

The server 10 is a server computer. The server 10 includes a control unit 11, a storage unit 12, and a communication unit 13. The control unit 11 includes at least one processor. The control unit 11 executes processing according to the programs and data stored in the storage unit 12. The storage unit 12 includes a main storage unit and an auxiliary storage unit. For example, the main storage unit is a volatile memory such as RAM, and the auxiliary storage unit is a non-volatile memory such as ROM, EEPROM, flash memory, or hard disk. The communication unit 13 is a communication interface for wired communication or wireless communication, and performs data communication via the network N.

The user terminal 20 is a computer operated by the user. For example, the user terminal 20 is a mobile phone (including a smartphone), a mobile information terminal (including a tablet computer), a personal computer, or the like. In the present embodiment, the user terminal 20 includes a control unit 21, a storage unit 22, a communication unit 23, an operation unit 24, and a display unit 25. The physical configurations of the control unit 21, the storage unit 22, and the communication unit 23 may be the same as those of the control unit 11, the storage unit 12, and the communication unit 13, respectively.

The operation unit 24 is an input device, for example, a pointing device such as a touch panel or a mouse, a keyboard, a button, or the like. The operation unit 24 transmits the operation content by the user to the control unit 21. The display unit 25 is, for example, a liquid crystal display unit, an organic EL display unit, or the like. The display unit 25 displays an image according to the instruction of the control unit 21.

The programs and data described as being stored in the storage units 12 and 22 may be supplied via the network N. Further, the hardware configuration of each computer described above is not limited to the above example, and various hardware can be applied. For example, even if a reading unit for reading a computer-readable information storage medium (for example, an optical disk drive or a memory card slot) or an input / output unit for inputting / outputting data to / from an external device (for example, a USB port) is included. good. For example, the program or data stored in the information storage medium may be supplied to each computer via the reading unit or the input / output unit.

Further, the number of service providing systems 1 may be arbitrary and is not limited to three. For example, two service providing systems 1 may exist, or four or more service providing systems may exist. Further, for example, a plurality of services may be provided by one service providing system 1. Further, the service providing system 1 may include at least one computer, for example, a plurality of servers 10 may be included, or a computer other than the server computer may be included. Further, although only one user terminal 20 is shown in FIG. 1, a plurality of user terminals 20 may exist.

[1-2. Overview of fraud estimation system]
In the present embodiment, the service providing system 1 manages a blacklist indicating an unauthorized user.

The fraudulent user may mean a user who actually committed fraud, or may mean a user who may commit fraud in the future. For example, a user who violates the terms of service, a user who violates the law, or a user who may have these acts corresponds to an unauthorized user. Also, for example, a user who has illegally accessed, illegally used a credit card, hijacked another person's account, hacked, cracked, maliciously posted, intentionally mass-accessed, or harassed another user is an unauthorized user. Equivalent to.

A blacklist is a list in which user information about an unauthorized user is stored. In other words, a blacklist is data that can identify unauthorized users. Blacklisted unauthorized users are restricted from using the service. For example, suspending the user ID (user account) itself or disabling some functions of the service corresponds to restricting the use of the service. In addition, when fraud is presumed, the use of the service does not need to be restricted immediately, the use of the service may be restricted after the administrator's examination is performed, and additional authentication is performed for the user. After that, the use of the service may be restricted.

The blacklist may be manually edited by the service administrator, or may be automatically edited by the service providing system 1 analyzing the user's behavior. Further, the item of user information stored in the blacklist (hereinafter referred to as the blacklist item) may be common to all services, but in the present embodiment, the blacklist item corresponding to the service is defined. It is assumed that there is.

For example, the blacklist item of service A is a user ID, and the user ID of an unauthorized user in service A is stored in the blacklist of service A. The service providing system 1a determines whether or not the user ID of the user who is going to use the service A is stored in the blacklist. The service providing system 1a restricts the use of the service A by the user whose user ID is stored in the blacklist.

Further, for example, the blacklist items of the service B are the user ID and the device ID of the user terminal 20, and the user ID and the device ID of the unauthorized user in the service B are stored in the blacklist of the service B. Will be done. The service providing system 1b determines whether or not either the user ID or the device ID of the user who intends to use the service B is stored in the blacklist. The service providing system 1b restricts the use of the service B by a user whose user ID or device ID is stored in the blacklist. The use of service B may be restricted on the condition that either the user ID or the device ID is not stored in the blacklist, but both of them are stored in the blacklist.

Further, for example, the blacklist item of the service C is a credit card card number, and the card number of an unauthorized user in the service C is stored. The service providing system 1c determines whether or not the card number of the user who intends to use the service C is stored in the blacklist. The service providing system 1c restricts the use of the service C by the user whose card number is stored in the blacklist.

As described above, the service providing system 1 restricts the use of the service by unauthorized users on its own blacklist. However, even if it is not on the blacklist of the service providing system 1, there are users who commit fraud, so it may not be possible to prevent such user fraud simply by utilizing their own blacklist.

For example, if a fraudulent user in service C cheats by using a card number different from the card number stored in the blacklist, the other card number is not on the blacklist of service C. Fraud cannot be prevented. In this regard, the fraudulent user may be fraudulent in other services A and B, and may have registered the other card number in the other services A and B. Therefore, if it can be detected that the card number of the user who uses the service C matches the card number of the unauthorized user in the other services A and B, the fraud can be prevented.

Therefore, in the fraud estimation system S, whether or not a user of a certain service providing system 1 is a fraudulent user is estimated by using a blacklist of another service providing system 1. In the present embodiment, the processing of the fraud estimation system S will be described by taking as an example the case where the fraud of the user who is trying to register the user in the service C is estimated by using the blacklist of the services A and B.

FIG. 2 is an explanatory diagram showing an outline of processing of the fraud estimation system S. The shaded items in FIG. 2 are blacklist items. As described above, the blacklist item of the service A is the user ID, the blacklist item of the service B is the user ID and the device ID, and the blacklist item of the service C is the card number.

As shown in FIG. 2, the user U who starts using the service C is a user having a plurality of items such as a user ID, a name, an address, a telephone number, a date of birth, a card number, an IP address of the user terminal 20, and a device ID. Enter the information. In the present embodiment, the case where the user U inputs the user ID by himself / herself will be described, but the user ID may be automatically assigned by the service providing system 1c.

The service providing system 1c requests the service providing systems 1a and 1b to compare the card number input by the user U with the card number of the unauthorized user on the blacklist of the services A and B. That is, the service providing system 1c requests the service providing systems 1a and 1b to determine whether or not the unauthorized user in the services A and B has registered the card number of the user U.

The service providing system 1a refers to the card number registered in the service A by the unauthorized user on its own blacklist, and compares it with the card number received from the service providing system 1c. Similarly, the service providing system 1b refers to the card number registered in the service B by the unauthorized user on its blacklist and compares it with the card number received from the service providing system 1c.

Each of the service providing systems 1a and 1b transmits a comparison result (whether or not the card numbers match) to the service providing system 1c. In the service providing system 1c, if the card number of the fraudulent user in the services A and B and the card number of the credit card owned by the user U do not match, the user U is fraudulent in the other services A and B. Since it is highly probable that you are not working, user registration is permitted.

On the other hand, in the service providing system 1c, when the card number of the unauthorized user in the services A and B and the card number of the credit card owned by the user U match, the user U can use the other services A and B. Since it is the same user as the fraudulent user of the above and there is a high possibility that the fraudulent activity will be performed even in the service C, the user registration is restricted.

In this regard, some services A and B have a low relevance to service C. In estimating the fraud of user U in service C, if the blacklist of other services with low relevance and the blacklist of services with high relevance are treated equally, the fraud estimation accuracy can be sufficiently improved. It may not be possible. For example, even if the user becomes an unauthorized user in the service B, if the same card number is used and the service C does not perform the illegal operation, the comparison result of the service B can be used as it is, and the user in the service C can be used. Registration may be overly restricted.

Therefore, the service providing system 1c calculates the fraudulent degree of the user U who is trying to register as a user in the service C based on the relevance information regarding the relevance between the service C and the services A and B.

The relevance information is information indicating the high degree of relevance between a plurality of services. Relevance is the high probability (probability) that a user who cheats on one service will cheat on the other service. In other words, relevance is a high percentage of the characteristics of a rogue user of one service and the characteristics of a rogue user of the other service in common. In the present embodiment, the case where the relevance information is a numerical value (weighting coefficient) will be described, but the high degree of relevance may be represented by an index other than the numerical value such as a symbol. The higher the numerical value indicated by the relevance information, the higher the relevance.

The degree of fraud is the probability (probability) that the user U is a fraudulent user. The higher the degree of fraud, the higher the probability that the user U will commit fraud in service C. In this embodiment, the degree of fraud increases as the card numbers match and the relevance increases. When estimating fraud using items other than the card number (for example, name, address, etc.), the degree of fraud is such that the other items match and the degree of relevance is high. It gets higher. Further, in the present embodiment, the case where the degree of fraud is a numerical value will be described, but the degree of fraud may be represented by an index other than a numerical value such as a symbol.

In the example of FIG. 2, the relevance between the card number of service A and the card number of service C is relatively high, and the relevance information is 0.8. For example, the ratio of the card number used by the unauthorized user in the service A to be used as the illegal card number in the service C is calculated, and when this ratio is about 80%, the card number of the service A and the service C The relevance information with the card number of is set to 0.8.

On the other hand, the relevance between the card number of service B and the card number of service C is relatively low, and the relevance information is 0.3. For example, the ratio of the card number used by an unauthorized user in service B to be used as an illegal card number in service C is calculated, and when this ratio is about 30%, the card number of service A and service C The relevance information of the card number of is set to 0.3.

In the present embodiment, the relevance information is also set between the user ID, which is a blacklist item of the service A, and the card number of the service A. In the example of FIG. 2, it is highly probable that the user ID of the unauthorized user and the card number in the service A are related, and the relationship information between the user ID and the card number is 0.9. In the example of FIG. 2, the relevance information between the card number which is the blacklist item of the service C and the card number of the service A is 0.8, and the user ID which is the blacklist item of the service A and the card number of the service A. The relevance information with and is 0.9, and the relevance information between service A and service C is 0.72 multiplied by these.

On the other hand, the probability that the user ID of the unauthorized user and the card number in the service B are related is moderate, and the relationship information between the user ID of the service B and the card number of the service B is 0.6. In the example of FIG. 2, the relevance information between the card number which is the blacklist item of the service C and the card number of the service B is 0.3, and the user ID which is the blacklist item of the service B and the card number of the service B. The relevance information with and is 0.6, and the relevance information between service A and service B is 0.18 multiplied by these. In the present embodiment, the relevance information is also set between the blacklist items, and in the service B, the user ID and the device ID, which are the blacklist items, have low relevance, and the relevance information is 0. It is 1.

For example, the card number of an unauthorized user whose user ID is listed on the blacklist of service A and the card number of user U match, and the card number and user U of an unauthorized user whose user ID is listed on the blacklist of service B. If the card number matches, the fraudulent degree will be "0.9" of "0.8 * 0.9 + 0.3 * 0.6".

Further, for example, the card number of the unauthorized user whose user ID is listed on the blacklist of service A and the card number of the user U match, but the card number of the unauthorized user whose user ID or device ID is listed on the blacklist of service B. If the card number of the user U and the card number of the user U do not match, the degree of fraud is "0.72" of "0.8 * 0.9".

Further, for example, the card number of the unauthorized user whose user ID is listed on the blacklist of service A and the card number of user U do not match, but the card number of the unauthorized user whose user ID is listed on the blacklist of service B and the card number of the unauthorized user. If the card number of the user U matches, the fraudulent degree is "0.18" of "0.3 * 0.6".

Further, for example, the card number of the unauthorized user whose user ID is listed on the blacklist of service B and the card number of the user U do not match, but the card number of the unauthorized user whose device ID is listed on the blacklist of service B and the card number of the unauthorized user. If the card number of the user U matches, the fraudulent degree is "0.018" of "0.3 * 0.6 * 0.1".

The service providing system 1c determines whether or not the calculated fraud degree is equal to or higher than a threshold value (for example, 0.7). When the degree of fraud is less than the threshold value, the service providing system 1c presumes that the user U is not fraudulent in the service C, and permits the user registration of the service C. On the other hand, when the degree of fraud is equal to or higher than the threshold value, the service providing system 1c presumes that the user U is fraudulent in the service C and restricts the user registration of the service C.

As described above, in the fraud estimation system S of the present embodiment, not only the comparison result of the card number of the user registered as the user in the service C and the card number of the fraudulent user of each of the services A and B, but also the relevance. By estimating user fraud in consideration of information, the accuracy of fraud estimation is improved without making user registration excessively strict. Hereinafter, the details of this technique will be described. In the following description, the code of the user U who is registered as a user in the service C is omitted.

[1-3. Functions realized in fraud estimation system]
FIG. 3 is a functional block diagram showing an example of the functions realized by the fraud estimation system S. In the present embodiment, a case where the functions realized by the service providing systems 1a and 1b and the functions realized by the service providing system 1c are different will be described, but as in the modified example described later, the service providing systems 1a to Each of 1c may have a similar function.

[1-3-1. Functions realized in service A]
As shown in FIG. 3, in the service providing system 1a of the service A, the data storage unit 100a and the comparison unit 101a are realized.

[Data storage]
The data storage unit 100a is mainly realized by the storage unit 12a. The data storage unit 100a stores data necessary for executing the process described in the present embodiment. Here, as an example of the data stored in the data storage unit 100a, the user database DB1a of the service A and the blacklist BLa of the service A will be described.

FIG. 4 is a diagram showing a data storage example of the user database DB1a of the service A. As shown in FIG. 4, the user database DB1a is a database in which user information of a user registered as a user in service A is stored. For example, the user database DB1a stores a user ID that uniquely identifies a user and registration information registered by the user at the time of user registration. The registration information is user information other than the user ID, and is, for example, personal information of the user.

The user database DB1a stores user information for each of a plurality of items. The item is a type or content of user information. As shown in FIG. 4, in the present embodiment, the user database DB1a contains the user ID, name, address, telephone number, date of birth, credit card number, IP address of the user terminal 20, and the user terminal 20. Eight items of user information such as device ID are stored.

The user information stored in the user database DB1a is not limited to the example of FIG. The user database DB1a may store user information of arbitrary items, for example, work place, job title, age, gender, nickname, face photo, SIM information of user terminal 20, password, biometric information, etc. User information of items such as authentication information, e-mail address, access location information, or access date and time may be stored.

FIG. 5 is a diagram showing a data storage example of the blacklist BLa of the service A. In the present embodiment, since the user ID is a blacklist item of the service A, the user ID of the unauthorized user in the service A is stored in the blacklist BLa of the service A. For example, the administrator of the service A operates his / her own terminal and registers the user ID of the unauthorized user in the blacklist BLa.

Further, for example, the service providing system 1a analyzes the user's behavior, estimates a user who matches a predetermined rule as an unauthorized user, and registers the user ID of the unauthorized user in the blacklist BLa. Any rule can be applied, and the rule may be, for example, a rule regarding a payment amount, a payment frequency, an access location, or an access time. Further, for example, the service providing system 1a may detect a fraudulent user by using a machine learning model for detecting the fraudulent user, and register the user ID of the detected fraudulent user in the blacklist BLa.

The blacklist BLa may store user information of items other than the blacklist items. For example, user information (for example, name or address) of an item other than the user ID of an unauthorized user may be acquired from the user database DB1a and stored in the blacklist BLa together with the user ID which is a blacklist item.

[Comparison section]
The comparison unit 101a is mainly realized by the control unit 11a. The comparison unit 101a compares the user information of the target user in one service with the user information of an unauthorized user in another service.

One service is a service used by the target user. The target user is a user who is the target of fraud estimation. In other words, the target user is a user to be processed by the estimation unit 106c, which will be described later. Other services are services other than one service. In other services, the same person as one service may be registered as a user.

In the present embodiment, the case where the fraud of the user in the service C is presumed will be described. Therefore, the service C corresponds to one service, and the services A and B correspond to the other services. Therefore, the part explaining the service C in the present embodiment can be read as one service, and the part explaining the service A or the service B can be read as another service. Further, the part explaining the user who is using the user registration in the service C can be read as the target user.

The comparison unit 101a compares the user information of the target user in the service C with the user information of the unauthorized user in the service A. An unauthorized user in service A is a user on the blacklist BLa of service A. That is, the unauthorized user in the service A is a user whose user ID is stored in the blacklist BLa of the service A.

In the present embodiment, the case where the card numbers, which are the blacklist items of the service C, are compared will be described, but the user information of any item may be compared. For example, the user information of items other than the blacklist item of service C may be compared, or the user information of a plurality of items including the blacklist item of service C and other items may be compared.

For example, the comparison unit 101a acquires the card number of the target user from the service providing system 1c of the service C. The comparison unit 101a acquires the card number of the unauthorized user in the service A (that is, the card number associated with the user ID stored in the blacklist BLa) based on the user database DB1a and the blacklist BLa.

The comparison unit 101a compares the card number of the target user in the service C with the card number of the unauthorized user in the service A. The comparison unit 101a transmits the comparison result to the service providing system 1c of the service C. The comparison result may be in any data format and is either a value indicating that the card numbers match or a value indicating that the card numbers do not match.

In this embodiment, since the card numbers are compared, the case where the comparison unit 101a determines the exact match (same) of the card numbers will be described, but other user information such as an address and an e-mail address will be compared. In that case, the comparison unit 101a may determine a partial match (similarity) of the user information. That is, whether or not the target user of the service C and the unauthorized user of the service A are the same person may be estimated by a partial match instead of an exact match. As the partial match, any of a prefix match, an intermediate match, and a suffix match may be determined.

Further, in the present embodiment, since only the user ID, which is a blacklist item, is stored in the blacklist BLa of the service A, the comparison unit 101a refers to the user database DB1a to acquire the card number of the unauthorized user. However, when the card number is also stored in the blacklist BLa in association with the user ID of the unauthorized user, the comparison unit 101a may obtain the card number of the unauthorized user by referring to the blacklist BLa.

[1-3-2. Functions realized in service B]
As shown in FIG. 3, in the service providing system 1b, the data storage unit 100b and the comparison unit 101b are realized.

[Data storage]
The data storage unit 100b is mainly realized by the storage unit 12b. The data storage unit 100b stores data necessary for executing the process described in this embodiment. Here, as an example of the data stored in the data storage unit 100b, the user database DB1b of the service B and the blacklist BLb of the service B will be described.

FIG. 6 is a diagram showing a data storage example of the user database DB1b of the service B. As shown in FIG. 6, the user database DB1b of the service B is a database in which the user information of the user registered as a user in the service B is stored. In the present embodiment, the case where the items stored in the user database DB1a of the service A and the items stored in the user database DB1b of the service B are the same will be described. Since the details of each item stored in the user database DB1b of the service B are the same as those of the user database DB1a of the service A, the description thereof will be omitted.

In this embodiment, a unique user ID is issued for each service. Therefore, even if they are the same person, the user ID of the service A and the user ID of the service B are different. Further, when the same person uses a plurality of credit cards, the card number of the service A and the card number of the service B may be different. Similarly, for other items, the user information of the service A and the user information of the service B may be different even if they are the same person.

The items stored in the user database DB1a of the service A and the items stored in the user database DB1b of the service B may be different. For example, the address may be stored in the user database DB1a of the service A, but the address may not be stored in the user database DB1b of the service B. This point is the same for service C, and in the present embodiment, when the items stored in the user database DB1c of service C and the items stored in the user databases DB1a and DB1b of services A and B are the same. However, these items may be different. User information of items required for user registration may be registered in each service.

FIG. 7 is a diagram showing a data storage example of the blacklist BLb of the service B. As shown in FIG. 7, in the present embodiment, the two items of the user ID and the device ID are the blacklist items of the service B. Therefore, the blacklist BLb of the service B contains the user ID and the device ID of the unauthorized user in the service B. Stored.

The blacklist BLb of the service B is different from the blacklist BLa of the service A in that the blacklist items are different, and the other points are the same, so the description thereof will be omitted. The "service A", "service providing system 1a", "user ID", and "blacklist BLa" in the description of the blacklist BLa of the service A are referred to as "service B", "service providing system 1b", "user ID and", respectively. It may be read as "device ID" and "blacklist BLb".

[Comparison section]
The comparison unit 101b is mainly realized by the control unit 11b. The comparison unit 101b compares the user information of the target user in the service C with the user information of the unauthorized user in the service B. Since the processing of the comparison unit 101b is the same as the processing of the comparison unit 101a, the description thereof will be omitted. The "service A", "user ID", "user database DB1a", and "blacklist BLa" in the description of the comparison unit 101a are referred to as "service B", "user ID and device ID", "user database DB1b", and "user database DB1b", respectively. It may be read as "blacklist BLb".

[1-3-3. Functions realized in service C]
As shown in FIG. 3, in the service providing system 1c, a data storage unit 100c, a setting unit 102c, a registration reception unit 103c, a relevance information acquisition unit 104c, a comparison result acquisition unit 105c, and an estimation unit 106c are realized.

[Data storage]
The data storage unit 100c is mainly realized by the storage unit 12c. The data storage unit 100c stores data necessary for executing the process described in this embodiment. Here, as an example of the data stored in the data storage unit 100c, the user database DB1c of the service C, the blacklist BLc of the service C, and the relevance information database DB2 will be described.

FIG. 8 is a diagram showing a data storage example of the user database DB1c of the service C. As shown in FIG. 8, the user database DB1c of the service C is a database in which the user information of the user registered as a user in the service C is stored. In the present embodiment, the details of each item stored in the user database DB1c of the service C are the same as those of the user databases DB1a and DB1b of the services A and B, and thus the description thereof will be omitted.

FIG. 9 is a diagram showing a data storage example of the blacklist BLc of the service C. As shown in FIG. 9, since the card number is the blacklist item of the service C in the present embodiment, the card number of the unauthorized user in the service C is stored in the blacklist BLc of the service C.

The blacklist BLc of service C is different from the blacklist BLc of service A in that the blacklist items are different, and the other points are the same, so the description thereof will be omitted. "Service A", "Service provision system 1a", "User ID", and "Blacklist BLa" in the explanation of the blacklist BLa of service A are "Service C", "Service provision system 1c", and "Card number", respectively. , "Blacklist BLc" may be read.

FIG. 10 is a diagram showing a data storage example of the relevance information database DB2. As shown in FIG. 10, the relevance information database DB2 is a database in which relevance information is stored. In the present embodiment, there are two types of relevance: relevance information indicating the relevance between an item of a certain service and an item of another service, and relevance information indicating a relevance between a plurality of items in a certain service. Information exists. These two types of relevance information are stored in the relevance information database DB2. As described with reference to FIG. 2, in the present embodiment, the above two types of relevance information are prepared, and the relevance between services is expressed by a value obtained by multiplying these two types of relevance information. Will be done.

In the data storage example of FIG. 10, the relevance information described with reference to FIG. 2 is stored in the relevance information database DB2. For example, as the relevance information indicating the relevance between the item of a certain service and the item of another service, "0.8" which is the relevance information between the card number of the service A and the card number of the service C and the service B "0.3", which is the relationship information between the card number of the service C and the card number of the service C, is stored. In the present embodiment, the relevance of the card numbers between the services is shown, but the relevance information common to a plurality of items may be prepared regardless of the specific user information.

Further, for example, as the relevance information indicating the relevance between a plurality of items in a certain service, "0.9" which is the relevance information between the user ID of the service A and the card number of the service A, and the user ID of the service B. "0.1", which is the relationship information between the service B and the device ID of the service B, and "0.6", which is the relationship information between the user ID of the service B and the card number of the service B, are stored.

In the present embodiment, the case where the relevance information is set by the setting unit 102c described later will be described, but the relevance information may be manually set by the administrator of the service C.

[Settings]
The setting unit 102c is mainly realized by the control unit 11c. The setting unit 102c sets the relevance information based on the comparison result between the user information of the unauthorized user in the service C and the user information of the unauthorized user in the services A and B. The setting unit 102c may set the relevance information based on the comparison result of the user information of any item, may use the comparison result of the user information of a plurality of items, or compare the user information of one item. You may use the result.

For example, the setting unit 102c sets the relevance information based on the comparison result between the card number of the unauthorized user in the service C and the card number of the unauthorized user in the other services A and B. The setting unit 102c transmits all the card numbers stored in the blacklist BLc of the service C (that is, the card number of the unauthorized user in the service C) to the service providing system 1a of the service A, and the unauthorized user in the service A. Request a comparison with the card number of. In addition, only a part of the card numbers stored in the blacklist BLc of the service C may be transmitted.

When the service providing system 1a receives the card number of the unauthorized user in the service C, the service providing system 1a refers to the user database DB1a of the service A and the card number associated with the user ID stored in the blacklist BLa of the service A (in the service A). Obtain the card number of an unauthorized user). The service providing system 1a compares the card number of the fraudulent user in the service C with the card number of the fraudulent user in the service A. The service providing system 1a aggregates the number of matching numbers (hereinafter referred to as the aggregated number) and transmits the aggregated number to the service providing system 1c.

The setting unit 102c sets the relevance information between the card number of the service A and the card number of the service C based on the total number received from the service providing system 1a. It is assumed that the calculation formula showing the relationship between the total number and the numerical value of the relevance information is stored in advance in the data storage unit. This calculation formula is defined so that the larger the number of aggregates, the higher the numerical value indicated by the relevance information. The setting unit 102c calculates the numerical value of the relevance information by substituting the total number into the calculation formula, and stores it in the relevance information database DB2.

Although the case where the card number comparison process is executed in the service providing system 1a of the service A has been described, the card number comparison process may be executed in the service providing system 1c. In this case, the service providing system 1c acquires the card number of the unauthorized user of the service A from the service providing system 1a, and executes the card number comparison process.

Further, the process of setting the relevance information between the card number of the service A and the card number of the service B is the same as the process of setting the relevance information between the card number of the service A and the card number of the service C. Therefore, the description is omitted. The "service A", "service providing system 1a", "user ID", and "blacklist BLa" in the above description are referred to as "service B", "service providing system 1b", "user ID and device ID", and "", respectively. It may be read as "blacklist BLb".

In the present embodiment, the setting unit 102c also sets the relevance information between a plurality of items in a certain service. For example, the setting unit 102c stores the numerical value specified by the administrator of the service A in the relevance information database DB2 as the value of the relevance information between the user ID and the card number in the service A. Further, for example, the setting unit 102c stores the numerical value specified by the administrator of the service B in the relevance information database DB2 as the relevance information between the user ID and the card number in the service B. Further, for example, the setting unit 102c is based on the ratio in which the card number of the user whose user ID is stored in the blacklist BLb and the card number of the user whose device ID is stored in the blacklist BLb match in the service B. Then, the value of the relevance information between the user ID and the device ID in the service B is set.

[Registration reception department]
The registration reception unit 103c is mainly realized by the control unit 11c. The registration reception unit 103c accepts user registration in service C. User registration is to register user information in service C in order to start using service C. User registration is sometimes referred to as usage registration or service registration. For example, the registration reception unit 103c accepts user registration by receiving user information input by the user using the operation unit 24 from the user terminal 20.

[Relevance information acquisition department]
The relevance information acquisition unit 104c is mainly realized by the control unit 11c. The relevance information acquisition unit 104c acquires relevance information regarding the relevance between the service C and the services A and B. In the present embodiment, the relevance information is stored in the relevance information database DB2, so that the relevance information acquisition unit 104c refers to the relevance information database DB2 stored in the data storage unit 100c and relevance information. To get.

Further, in the present embodiment, each of the services A and B corresponds to another service, and there are a plurality of other services. Therefore, the relevance information acquisition unit 104c has a plurality of associations corresponding to the plurality of other services. You will get sexual information. That is, the relevance information acquisition unit 104c acquires relevance information regarding the relevance of one service to the other service for each other service.

Further, in the present embodiment, the card number which is the blacklist item of the service C is the comparison target, and the card number is not the blacklist item of the services A and B. Therefore, the relevance information acquisition unit 104c can use the services A and B. Acquires relevance information regarding the relevance of the blacklist item in the above and the card number that is not the blacklist item in the services A and B.

The blacklist items in services A and B are an example of the first item according to the present invention. The first item may be an item used when fraud is presumed in services A and B, which are other services. Therefore, the part explaining the user ID which is the blacklist item of the service A or the user ID or the device ID which is the blacklist item of the service B in the present embodiment can be read as the first item.

The card number is an example of the second item according to the present invention. The second item is an item of user information to be compared when estimating fraud. In the present embodiment, the card numbers, which are the blacklist items of the service C, are compared, so that the part explaining the card numbers can be read as the second item. The relevance information acquisition unit 104c acquires the relevance information between the user ID and the card number in the service A and the relevance information between the user ID and the card number in the service B.

In the other service B, fraud is presumed based on the user information of each of the plurality of first items, so that the relevance information acquisition unit 104c is responsible for the relevance of each of the plurality of first items in the other service. You may get the relevance information about. In the present embodiment, the user ID and the device ID are blacklist items, and their relevance information is prepared. Therefore, the relevance information acquisition unit 104c has the relevance information regarding the relevance between the plurality of blacklist items. To get.

[Comparison result acquisition section]
The comparison result acquisition unit 105c is mainly realized by the control unit 11c. The comparison result acquisition unit 105c acquires the comparison result between the user information of the target user in the service C and the user information of the unauthorized user in the services A and B. In the present embodiment, each of the services A and B corresponds to another service, and there are a plurality of other services. Therefore, the comparison result acquisition unit 105c acquires a plurality of comparison results corresponding to each of the plurality of other services. do.

In service C, fraud is presumed based on the card number, so the comparison result acquisition unit 105c acquires the comparison result between the card number of the target user in service C and the card number of the fraudulent user in other services. .. The card number corresponds to the user information of a predetermined item according to the present invention. The predetermined item may be an item used when fraud is presumed in service C, which is one service. Therefore, the part explaining the card number, which is a blacklist item of the service C in the present embodiment, can be read as a predetermined item.

Further, as described above, since the card number corresponds to the second item, the comparison result acquisition unit 105c has the user information of the second item of the target user in the service C and the second item of the unauthorized user in the services A and B. The comparison result with the user information of.

In the present embodiment, the comparison process is not executed in the service C, but in the services A and B, the card number of the target user in the service C and the card number of the unauthorized user in the services A and B are compared. Therefore, the comparison result acquisition unit 105c acquires the comparison result from the services A and B. That is, when the comparison result acquisition unit 105c acquires the comparison result, the card numbers of the services A and B are not transmitted in the network N. The comparison result acquisition unit 105c acquires the comparison result corresponding to the services A and B for each of the services A and B.

[Estimator]
The estimation unit 106c is mainly realized by the control unit 11c. The estimation unit 106c estimates the fraud of the target user based on the relevance information acquired by the relevance information acquisition unit 104c and the comparison result acquired by the comparison result acquisition unit 105c. The estimation is to determine or determine whether or not the target user is an unauthorized user. The estimation result by the estimation unit 106c may be the final result of whether or not the user is an unauthorized user, or may be left to the judgment of the administrator thereafter.

For example, the estimation unit 106c calculates the degree of fraud based on the relevance information and the comparison result, and determines whether or not the degree of fraud is equal to or greater than the threshold value. If the degree of fraud is equal to or higher than the threshold value, the estimation unit 106c estimates that the target user is fraudulent, and if the degree of fraud is less than the threshold value, estimates that the target user is normal.

It is assumed that the calculation formula of the degree of fraud is stored in advance in the data storage unit. This calculation formula is defined so that the higher the comparison result indicates that the card numbers match and the higher the numerical value indicated by the relevance information, the higher the degree of fraud. The estimation unit 106c substitutes the relevance information and the comparison result into the calculation formula, and calculates the degree of fraud. In the present embodiment, as described above, the case where the total value obtained by multiplying the plurality of relevance information is calculated as the fraud degree will be described, but the calculation formula can be appropriately set by the administrator of the service C or the like. ..

In the present embodiment, each of the services A and B corresponds to another service, and there are a plurality of other services. Therefore, the estimation unit 106c is based on a plurality of relevance information and a plurality of comparison results. Estimate the fraud of the target user. For example, the estimation unit 106c substitutes a plurality of relevance information and a plurality of comparison results into the calculation formula, and calculates the degree of fraud.

Further, in the present embodiment, since fraud at the time of user registration is presumed, the target user is a user who registers as a user. The estimation unit 106c estimates the fraud of the target user when the user registration is accepted. For example, the estimation unit 106c estimates the fraud of the target user before the user registration is completed. The estimation unit 106c may estimate the fraud of the target user after the user registration is completed.

Further, in the present embodiment, the relevance information is also defined between the items in the other services A and B, so that the estimation unit 106c can use the relevance information regarding the relevance between the items in the other services A and B. Based on this, the fraud of the target user is estimated. That is, the estimation unit 106c is fraudulent of the target user based on not only the relevance information between the item of service C and the items of services A and B but also the relevance information between the items of each of services A and B. To estimate.

The estimation method by the estimation unit 106c is not limited to the method using the degree of fraud, and any method can be used. For example, a predetermined rule regarding the comparison result and the relevance information is defined, and the estimation unit 106c is based on the relevance information acquired by the relevance information acquisition unit 104c and the comparison result acquired by the comparison result acquisition unit 105c. Therefore, fraud may be estimated by determining whether or not the rule is satisfied. In addition, for example, the estimation unit 106c features a relevance information acquired by the relevance information acquisition unit 104c and a comparison result acquired by the comparison result acquisition unit 105c, and a machine learning model for estimating fraud. May be used to estimate fraud.

[1-4. Processing executed in the fraud estimation system]
11 and 12 are flow charts showing an example of processing executed in the fraud estimation system S. The processes shown in FIGS. 11 and 12 are executed by the control units 11 and 21 operating according to the programs stored in the storage units 12 and 22, respectively. The process described below is an example of the process executed by the functional block shown in FIG.

As shown in FIG. 11, first, in the user terminal 20, the control unit 11 transmits a display request of the registration screen for user registration to the service providing system 1c (S1). For example, on the registration screen, an input form for inputting user information of a plurality of items required for user registration is displayed. The display request of the registration screen is transmitted at an arbitrary timing such as when the URL of the registration screen is selected.

In the service providing system 1c, when the display request is received, the control unit 11c transmits the display data of the registration screen to the user terminal 20 (S2). The display data may be in any data format, for example HTML data. It is assumed that the display data on the registration screen is stored in advance in the storage unit 12c.

When the user terminal 20 receives the display data, the control unit 21 causes the display unit 25 to display the registration screen based on the display data (S3). When the registration screen is displayed in S3, the user operates the operation unit 24 to input the user information of the eight items shown in FIG. The control unit 21 transmits user information of a plurality of items input by the user from the operation unit 24 to the service providing system 1c (S4). It is not necessary to input all eight items, and some items may not be input.

Upon receiving the user information in the service providing system 1c, the control unit 11c determines whether or not the card number input by the user is stored in the blacklist BLc of the service C (S5). In S5, the control unit 11c uses the card number input by the user as a query and searches the blacklist BLc of the service C.

When it is determined that the card number is stored in the blacklist BLc (S5; Y), the control unit 11c presumes that the user is illegal and restricts the user registration (S6). In S6, the control unit 11c refuses the user registration and restricts the user from using the service. In this case, a message such as "User registration is not possible with this card number" may be displayed on the user terminal 20. Alternatively, for example, the control unit 11c may suspend the completion of the user registration and send a notification asking the administrator of the service C whether or not to allow the user registration. In this case, if permission is obtained from the administrator of service C, user registration is permitted.

On the other hand, when it is not determined that the card number is stored in the blacklist BLc (S5; N), the process proceeds to FIG. Request the comparison process (S7). The request for comparison processing may be made by transmitting data in a predetermined format, and includes the card number entered by the user.

Upon receiving the card number in the service providing system 1a, the control unit 11a acquires the card number of the unauthorized user whose user ID is stored in the blacklist BLa of the service A based on the user database DB1a (S8). In S8, the control unit 11a acquires the card number of the unauthorized user of the service A.

The control unit 11a compares the card number input by the user in the service C with the card number of the unauthorized user in the service A (S9). In S9, the control unit 11a determines whether or not these card numbers match.

The control unit 11a transmits the comparison result in S9 to the service providing system 1c (S10). In S10, the control unit 11a transmits a comparison result indicating that the card numbers match or a comparison result indicating that the card numbers do not match, based on the processing result of S9. That is, the control unit 11a transmits a comparison result indicating whether or not there is an unauthorized user with the same card number.

On the other hand, in the service providing system 1b, when the card number is received, the control unit 11b acquires the card number of the unauthorized user whose user ID or device ID is stored in the blacklist BLb of the service B based on the user database DB1b. (S11). In S11, the control unit 11b acquires the card number of the unauthorized user of the service B.

The control unit 11b compares the card number input by the user in the service C with the card number of the unauthorized user in the service B (S12). In S12, the control unit 11b determines whether or not these card numbers match.

The control unit 11b transmits the comparison result in S12 to the service providing system 1c (S13). In S13, the control unit 11b transmits a comparison result indicating that the card numbers match or a comparison result indicating that the card numbers do not match, based on the processing result of S12. That is, the control unit 11b transmits a comparison result indicating whether or not there is an unauthorized user with the same card number.

In the service providing system 1c, when the comparison result is received from each of the service providing systems 1a and 1b, the control unit 11c is based on the relevance information stored in the relevance information database DB2 and the received comparison result. , Calculate the degree of fraud (S14). In S14, when there is another service having the same card number, the control unit 11c has the relationship information between the card number of the service C and the card number of the other service and the relationship between the items in the other service. The fraud degree is calculated by calculating the value obtained by multiplying the sex information by.

The control unit 11c determines whether or not the degree of fraud is equal to or greater than the threshold value (S15). It is assumed that the threshold value is stored in the storage unit 12c in advance. The threshold value may be a fixed value or a variable value.

When it is determined that the degree of fraud is equal to or higher than the threshold value (S15; Y), it is presumed that the user is fraudulent, the process proceeds to S6, and user registration is restricted. On the other hand, when it is determined that the degree of fraud is less than the threshold value (S15; N), the control unit 11c permits user registration (S16), and this process ends. In S16, it is presumed that the user is legitimate, and the user information input by the user is added to the user database DB1c.

According to the fraud estimation system S of the present embodiment, the fraud of the target user is based on the relevance information regarding the relationship between the service C and the services A and B and the comparison result of the card number of the target user in the service C. By estimating, the accuracy of estimating fraud can be improved. By increasing the accuracy of estimating fraud, it is possible to prevent a fraudulent user from committing fraud in service C and enhance security in service C. For example, even if the card number of the target user is not stored in the blacklist BLc of the service C, if the unauthorized user of the services A and B has registered the card number, the blacklist BLc of the services A and B will be displayed. Since the fraud of the target user can be estimated by using it, the fraud of the fraudulent user in the service C can be prevented. Further, by estimating the fraud in consideration of the relationship between the service C and the services A and B, it is possible to prevent the security from becoming excessively strict.

Further, the fraud estimation system S detects fraud of the target user based on a plurality of relevance information corresponding to each of the plurality of services A and B and a plurality of comparison results corresponding to each of the plurality of services A and B. By estimating, the accuracy of estimating the fraud of the user can be effectively improved, and the security in the service C can be further improved. For example, by using the blacklists BLa and BLb of multiple other services instead of using the blacklist of a single other service, the target user did not cheat on a specific other service. Even so, if the target user is cheating on another service, the fraud of the target user can be estimated. Furthermore, since the relevance to the service C differs depending on the services A and B, by considering the relevance information according to the services A and B, the accuracy of estimating fraud is improved and the security becomes excessively strict. This can be effectively prevented.

Further, the fraud estimation system S acquires the comparison result of the card numbers of the blacklist items of the target user in the service C, and estimates the fraud of the user by using the items important for the service C, so that the fraud of the user is estimated. The accuracy of the service can be effectively increased, and the security in the service C can be further improved.

Further, the fraud estimation system S uses the card number associated with the blacklist items of services A and B even if the card number to be compared is not the blacklist item of services A and B. The fraud of the user can be estimated, and the security in the service C can be improved.

Further, the fraud estimation system S can effectively improve the accuracy of estimating the fraud of the user by considering the relevance information regarding the relationship between the blacklist item and the card number in the services A and B, and the service. The security in C can be further improved.

Further, the fraud estimation system S can effectively improve the accuracy of estimating the fraud of the target user by estimating the fraud of the target user based on the relevance information of each of the plurality of blacklist items in the service B. It can be done, and the security in the service C can be further improved.

Further, the card number comparison process is executed in the service providing systems 1a and 1b, and the service providing system 1c acquires the comparison result from the service providing systems 1a and 1b, so that the card numbers of the services A and B are transmitted to the network N. Therefore, it is possible to prevent the leakage of personal information of services A and B. Further, since the service providing system 1c does not execute the comparison process, the processing load of the service providing system 1c can be reduced.

Further, the fraud estimation system S sets the relevance information based on the comparison result between the card number of the fraudulent user in the service C and the card number of the fraudulent user in the services A and B, thereby performing the fraudulent user. The accuracy of estimation can be effectively improved, and the security in service C can be further improved.

Further, the fraud estimation system S can prevent a fraudulent user from starting to use the service by estimating the fraud of the target user when the user registration is accepted.

[2. Embodiment 2]
Next, another embodiment of the fraud estimation system S (hereinafter, the second embodiment) will be described. The fraud estimation system S of the first embodiment estimates the fraud of the target user by considering not only the comparison result of the card numbers but also the relevance information, but the fraud of the target user is estimated without considering the relevance information in particular. You may estimate. In the second embodiment described below, the same points as those in the first embodiment will be omitted.

The functions of the service providing systems 1a and 1b of the second embodiment are the same as those of the first embodiment, but some functions of the service providing system 1c are different from those of the first embodiment. For example, the data storage unit 100c does not have to store the relevance information database DB2. Further, for example, in the service providing system 1c, the relevance information acquisition unit 104c may not be realized.

The comparison result acquisition unit 105c includes the user information of the predetermined item of the target user in the service C and the user information of the predetermined item of the unauthorized user in the services A and B in which the fraud is estimated based on the user information of the other items. Get the comparison result. In the second embodiment, as in the first embodiment, the case where the predetermined item is the card number of the blacklist item of the service C will be described, but the predetermined item may be another item. For example, a name or address that is not a blacklist item of service C may correspond to a predetermined item. That is, it is sufficient that the items to be compared at the time of fraud estimation and the blacklist items in services A and B are different.

The estimation unit 106c of the second embodiment estimates the fraud of the target user based on the comparison result acquired by the comparison result acquisition unit 105c. That is, the estimation unit 106c estimates the fraud of the target user without particularly considering the relevance information. For example, the estimation unit 106c estimates that the target user is invalid when the comparison result indicates that the card numbers match, and sets the target user when the comparison result indicates that the card numbers do not match. Presumed to be legitimate.

The estimation unit 106c may presume that the target user is fraudulent when the comparison result indicating that the card numbers match is obtained from both services A and B, or the estimation unit 106c may presume that the card is fraudulent from either service A or B. When the comparison result indicating that the numbers match is obtained, the target user may be presumed to be fraudulent. That is, the estimation unit 106c may presume that it is invalid when a certain number or more of the comparison results match. For example, when the comparison result is acquired from n services (n is an integer of 3 or more) instead of acquiring the comparison result from the two services A and B as in the present embodiment, the estimation unit. 106c may be presumed to be invalid when k or more comparison results (k is an integer of 3 or more and n or less) match.

According to the second embodiment, the fraud of the target user is estimated based on the comparison result between the card number of the target user in the service C and the card number of the fraudulent user in the services A and B whose card number is not a blacklist item. By doing so, the accuracy of estimating fraud can be improved. By increasing the accuracy of estimating fraud, it is possible to prevent a fraudulent user from committing fraud in service C and enhance security in service C. For example, even if the card number of the target user is not stored in the blacklist BLc of the service C, if the unauthorized user of the services A and B has registered the card number, the blacklist BLa of the services A and B, Since the fraud of the target user can be estimated using BLb, the fraud of the fraudulent user in the service C can be prevented.

[3. Modification example]
The present invention is not limited to the embodiments described above. It can be changed as appropriate without departing from the spirit of the present invention.

[3-1. Modification example according to the first embodiment]
(1-1) For example, in the embodiment, the fraud of the target user is presumed based on the card number, but the fraud of the target user may be presumed in consideration of items other than the card number. That is, the comparison result of each of the user information of a plurality of items may be used in the estimation of fraud.

The comparison result acquisition unit 105c acquires the comparison result between the user information of each of the plurality of items of the target user in the service C and the user information of each of the plurality of items of the unauthorized user in the services A and B. The method of acquiring each comparison result is as described in the first embodiment, and the comparison result acquisition unit 105c transmits each user information of a plurality of items to each of the services A and B, and each of the unauthorized users. Request the comparison process to see if it matches the user information of the item.

The comparison unit 101b of the service providing systems 1a and 1b compares the user information of each of the plurality of items of the target user in the service C with the user information of each of the plurality of items of the unauthorized user in the services A and B. The comparison unit 101b transmits the comparison result for each item to the service providing system 1c. The comparison result acquisition unit 105c acquires the comparison result of each of the plurality of items. The plurality of items to be compared may be predetermined, and may be, for example, a combination of a card number and an address or a name and a telephone number. Further, for example, the items to be compared are not limited to two, and may be any number of three or more.

The estimation unit 106c estimates the fraud of the target user based on a plurality of comparison results corresponding to the plurality of items. The estimation unit 106c calculates the degree of fraud based on a plurality of comparison results. For example, when the estimation unit 106c receives the comparison result indicating that the plurality of items match, the estimation unit 106c calculates the total of the values calculated based on the relevance information of each of the plurality of items as the fraud degree.

In this modification, the case where the user information of a plurality of items is transmitted to each of the services A and B has been described, but the service is such that the card number is transmitted to the service A and the address is transmitted to the service B. User information of different items may be transmitted and compared for each.

According to the modification (1-1), the user's fraud can be estimated based on a plurality of comparison results corresponding to each of the plurality of items, and the accuracy of estimating the user's fraud can be effectively improved, and the service C can be used. Security can be further improved.

(1-2) Further, for example, when fraud is presumed using a plurality of items as in the modified example (1-1), the relevance information common to the plurality of items may be used, but for each item. Relevance information may be defined in.

The relevance information database DB2 of this modification stores the relevance information of each of the plurality of items to be compared. The relevance information acquisition unit 104c acquires a plurality of relevance information corresponding to each of the plurality of items. The relevance information acquisition unit 104c refers to the relevance information database DB2 and acquires relevance information for each item to be compared.

The estimation unit 106c estimates the fraud of the target user based on a plurality of relevance information. For example, when the estimation unit 106c receives the comparison result indicating that the plurality of items match, the estimation unit 106c calculates the total of the values calculated based on the relevance information of each of the plurality of items as the fraud degree. The method of calculating the degree of fraud is as described in the first embodiment.

According to the modification (1-2), when estimating the user's fraud using a plurality of items, the accuracy of estimating the user's fraud is effectively improved by using the relevance information according to the items. It can be enhanced, and the security in service C can be further improved.

(1-3) Further, for example, in the first embodiment, the case where the fraud of the target user in the service C is presumed by using the user information of the fraudulent user in the services A and B has been described. The fraud of the target user in the service C may be presumed by using the user information of the legitimate user. In this modification, the service providing system 1 provides a white list instead of a black list.

The white list is a list in which user information about legitimate users is stored. In other words, a white list is a list that contains information that can identify a legitimate user. Legitimate users on the white list are not restricted from using the service.

The white list may be edited manually by the service administrator, or may be automatically edited by the service providing system 1 by analyzing the user's behavior. Further, the item of the user information stored in the white list (hereinafter referred to as the white list item) may be common to all services, but in the present embodiment, the white list item corresponding to the service is defined. It is assumed that there is.

The comparison result acquisition unit 105c of this modification acquires the comparison result between the user information of the target user in the service C and the user information of the legitimate user in the services A and B. The comparison result is either a value indicating that it matches the user information of the legitimate user or a value indicating that it does not match the user information of the legitimate user.

The estimation unit 106c calculates the correctness of the target user based on the relevance information and the comparison result. The legitimacy is a concept opposite to the fraudulent degree, and is a numerical value indicating the probability that the user U is a legitimate user. The higher the correctness, the higher the probability that the user U will not commit fraud in the service C.

For example, the estimation unit 106c calculates the correctness based on the relevance information and the comparison result, and determines whether or not the correctness is equal to or greater than the threshold value. If the correctness is equal to or greater than the threshold value, the estimation unit 106c estimates that the target user is valid, and if the correctness is less than the threshold value, estimates that the target user is not valid.

It is assumed that the calculation formula of the correctness is stored in advance in the data storage unit 100c. This calculation formula is defined so that the higher the numerical value indicated by the relevance information, the higher the validity is. The estimation unit 106c substitutes the relevance information and the comparison result into the calculation formula, and calculates the correctness.

According to the modification (1-3), the accuracy of estimating the user's fraud can be improved by estimating the fraud of the target user in the service C by using the white list in the services A and B, and the service C can be estimated. It is possible to further improve the security in.

The comparison result acquisition unit 105c may acquire the comparison result with the user information of the unauthorized user or the legitimate user in the other service, and may acquire only the comparison result of either one of them, or these Both comparison results may be obtained. That is, at least one of the blacklist and the whitelist in other services may be used so that the fraud of the target user can be presumed.

[3-2. Modification example according to the second embodiment]
(2) For example, also in the second embodiment, as in the modified example (1-1), the fraud of the target user may be estimated by using the comparison result of each of the user information of a plurality of items. In this case, it may be presumed to be fraudulent when the comparison results of a certain number or more of the items match. Further, for example, in the second embodiment as well, as in the modified example (1-3), the white list may be used to presume the fraud of the target user. That is, the comparison result acquisition unit 105c may acquire the comparison result with the user information of the predetermined item of the legitimate user in other services. The comparison result acquisition unit 105c does not presume that the target user is illegal when it matches the user information of the legitimate user in the other service, and does not match the user information of the legitimate user in the other service. Presumes that the target user is fraudulent.

[3-3. Other variants]
(3) Further, for example, the above modification may be combined.

Further, for example, the case where the user databases DB1a to DB1c are prepared for each service has been described, but a common user database may be prepared for all services. Further, for example, any item can be set as the blacklist item, and an item with a high probability of being used when fraudulently committing a service may be set as a blacklist item. Further, for example, the number of other services is not limited to two, and may be only one or three or more.

Further, for example, the case where fraud is presumed at the time of user registration has been described, but fraud at any timing other than at the time of user registration may be presumed. For example, fraud may be presumed when the user actually uses the service after the user registration is completed. Further, for example, it does not have to be the case where the user particularly uses the service, and fraud may be presumed at the timing specified by the administrator of the service C.

Further, for example, when the service providing system 1c is affiliated with a large number of services, an item to be compared may not be registered among the other services. Therefore, the service providing system 1c may specify the service in which the item to be compared is registered, and request the service providing system 1 of the specified service to perform the comparison process. In this case, it is assumed that the information indicating which item of user information is registered in which service is registered in the service providing system 1c.

Further, for example, in the first and second embodiments, the fraud of the target user in the service C is estimated as an example, but the fraud of the target user in the service A may be estimated. In this case, the service providing system 1a has the same function as the service providing system 1c described in the first and second embodiments, and the service providing system 1c has the same function as the comparison unit of the service providing systems 1a and 1b. .. For example, the service providing system 1a transmits the user information of the target user who registers the user of the service A to the service providing systems 1b and 1c, and acquires the comparison result from the service providing systems 1b and 1c. The service providing system 1a calculates the degree of fraud based on the relevance information between the service A and the services B and C and the comparison result, and estimates the fraud of the target user.

Further, for example, fraud of the target user in the service B may be presumed. In this case, the service providing system 1b has the same function as the service providing system 1c described in the first and second embodiments, and the service providing system 1c has the same function as the comparison unit of the service providing systems 1a and 1b. .. For example, the service providing system 1b transmits the user information of the target user who registers the user of the service B to the service providing systems 1a and 1c, and acquires the comparison result from the service providing systems 1a and 1c. The service providing system 1b calculates the degree of fraud based on the relevance information between the service B and the services A and C and the comparison result, and estimates the fraud of the target user.

Further, for example, all service providing systems 1 may have the same function. Further, for example, the case where the blacklist item is defined for each service has been described, but the blacklist item may be common to a plurality of services. For example, all blacklist items of services AC may be card numbers. In this case, the comparison units 101a and 101b may acquire the user information to be compared by referring to the blacklist without referring to the user databases DB1a and DB1b. Further, for example, the case where the service providing systems 1a and 1b are included in the fraud estimation system S has been described, but the service providing systems 1a and 1b may be a system outside the fraud estimation system S.

Further, for example, the case where the main functions are realized by the server 10 has been described, but each function may be shared by a plurality of computers. For example, the functions may be shared by each of the server 10 and the user terminal 20. Further, for example, when the fraud estimation system S includes a plurality of server computers, the functions may be shared by the plurality of server computers. Further, for example, the data described as being stored in the data storage units 100a to 100c may be stored by a computer other than the server 10.

Claims (14)

Relevance information acquisition means for acquiring relevance information regarding the relevance of one service to another service,
A comparison result acquisition means for acquiring a comparison result between the user information of the target user in the one service and the user information of an unauthorized user or a legitimate user in the other service.
An estimation means for estimating fraud of the target user based on the relevance information and the comparison result, and
A fraud estimation system characterized by including. The relevance information acquisition means acquires a plurality of relevance information corresponding to each of the plurality of other services, and obtains a plurality of relevance information.
The comparison result acquisition means acquires a plurality of comparison results corresponding to the plurality of other services, respectively.
The estimation means estimates the fraud of the target user based on the plurality of relevance information and the plurality of comparison results.
The fraud estimation system according to claim 1, wherein the fraud estimation system is characterized in that. In the above-mentioned one service, fraud is presumed based on the user information of a predetermined item, and fraud is estimated.
The comparison result acquisition means acquires the comparison result between the user information of the predetermined item of the target user in the one service and the user information of the predetermined item of the unauthorized user or the legitimate user in the other service.
The fraud estimation system according to claim 1 or 2, wherein the fraud estimation system is characterized in that. In the other services, fraud is presumed based on the user information of the first item, and fraud is presumed.
The comparison result acquisition means acquires the comparison result between the user information of the second item of the target user in the one service and the user information of the second item of the unauthorized user or the legitimate user in the other service. ,
The fraud estimation system according to any one of claims 1 to 3. The relevance information acquisition means acquires relevance information regarding the relevance between the first item and the second item in the other service, and obtains relevance information.
The estimation means estimates the fraud of the target user based on the relevance information regarding the relevance between the first item and the second item in the other service.
The fraud estimation system according to claim 4, wherein the fraud estimation system is characterized in that. In the other services, fraud is presumed based on the user information of each of the plurality of first items.
The relevance information acquisition means acquires relevance information regarding the relevance of each of the plurality of first items in the other service.
The estimation means estimates the fraud of the target user based on the relevance information regarding the relevance of each of the plurality of first items in the other service.
The fraud estimation system according to claim 4 or 5. The comparison result acquisition means obtains a comparison result between the user information of each of the plurality of items of the target user in the one service and the user information of each of the plurality of items of the unauthorized user or the legitimate user in the other service. Acquired,
The estimation means estimates the fraud of the target user based on a plurality of comparison results corresponding to the plurality of items.
The fraud estimation system according to any one of claims 1 to 6, wherein the fraud estimation system is characterized in that. The relevance information acquisition means acquires a plurality of relevance information corresponding to each of the plurality of items, and obtains a plurality of relevance information.
The estimation means estimates the fraud of the target user based on the plurality of relevance information.
The fraud estimation system according to claim 7, wherein the fraud estimation system is characterized in that. In the other service, the user information of the target user in the one service is compared with the user information of an unauthorized user or a legitimate user in the other service.
The comparison result acquisition means acquires the comparison result from the other service.
The fraud estimation system according to any one of claims 1 to 8, wherein the fraud estimation system is characterized in that. The fraud estimation system sets the relevance information based on the comparison result between the user information of the fraudulent user or the legitimate user in the one service and the user information of the fraudulent user or the legitimate user in the other service. Setting means,
The fraud estimation system according to any one of claims 1 to 9, further comprising. The fraud estimation system further includes a registration receiving means for accepting user registration in the one service.
The target user is a user who registers the user,
The estimation means estimates the fraud of the target user when the user registration is accepted.
The fraud estimation system according to any one of claims 1 to 10. The comparison result between the user information of the predetermined item of the target user in one service and the user information of the predetermined item of the unauthorized user or the legitimate user in the other service in which fraud is presumed based on the user information of the other item. Comparison result acquisition means to acquire and
Based on the comparison result, the estimation means for estimating the fraud of the target user and
A fraud estimation system characterized by including. Relevance information acquisition step to acquire relevance information about the relevance of one service to another service,
A comparison result acquisition step for acquiring a comparison result between the user information of the target user in the one service and the user information of an unauthorized user or a legitimate user in the other service.
An estimation means for estimating fraud of the target user based on the relevance information and the comparison result, and
A fraud estimation method characterized by including. Relevance information acquisition means for acquiring relevance information regarding the relevance of one service to another service,
A comparison result acquisition means for acquiring a comparison result between the user information of the target user in the one service and the user information of an unauthorized user or a legitimate user in the other service.
An estimation means for estimating fraud of the target user based on the relevance information and the comparison result,
A program to make your computer work as.

Images